Secure re-encryption of homomorphically encrypted data

Abstract

Securely re-encrypt homomorphically encrypted data by receiving fully homomorphically encrypted (FHE) information from a client device, training a machine learning model using the FHE information to generate FHE ciphertext, applying a first transformation to the FHE ciphertext to generate obfuscated FHE ciphertext, sending the obfuscated FHE ciphertext to a secure device, receiving a re-encrypted version of the obfuscated FHE ciphertext from the secure device, applying a second transformation to the re-encrypted version of the obfuscated FHE ciphertext to generate deobfuscated re-encrypted FHE ciphertext, determining FHE ML model parameters based on the deobfuscated re-encrypted ciphertext, and sending the FHE ML model parameters to the client device.

Description

Background Art

[0001] The present disclosure generally relates to protecting data protected using fully homomorphic encryption (FHE), and more particularly to obfuscating FHE data passed between a service provider and a hardware security module (HSM) provider.

[0002] Machine Learning as a Service (MLaaS) enables clients to provide training datasets to cloud or other network-based service providers for model training. The service provider receives the training datasets, develops a model using the training data, and passes the model parameters of the trained model to the client.

[0003] Using FHE to encrypt training data and decrypt model parameters enables the training process to continue without requiring the service provider to access the training dataset or learn any details about the training data or associated model parameters. Fully homomorphic encryption provides encrypted data that can be used to train the model and determine the model's parameters without decrypting the data. Training the model with encrypted data produces encrypted model parameters, which are passed to the user and decrypted using FHE. FHE provides users with access to the parameters of the trained model from the service provider without exposing the training data or the final model parameters to the service provider. Summary of the Invention

[0004] The following content presents a summary of the invention to provide a basic understanding of one or more embodiments of the present disclosure. This summary is not intended to identify key or important elements or to delineate any scope of a particular embodiment or any scope of the claims. Its sole purpose is to present concepts in a simplified form as a prelude to the more detailed description presented later. In one or more embodiments described herein, a device, system, computer-implemented method, apparatus, and / or computer program product allows for secure re-encryption of homomorphically encrypted data.

[0005] Various aspects of the present invention disclose methods, systems, and computer-readable media associated with securely re-encrypting homomorphically encrypted data, by: receiving fully homomorphically encrypted (FHE) information from a client device, training a machine learning model using the FHE information to produce FHE ciphertext, applying a first transformation to the FHE ciphertext to produce obfuscated FHE ciphertext, sending the obfuscated FHE ciphertext to a secure device, receiving a re-encrypted version of the obfuscated FHE ciphertext from the secure device, applying a second transformation to the re-encrypted version of the obfuscated FHE ciphertext to produce deobfuscated re-encrypted FHE ciphertext, determining FHE ML model parameters based on the deobfuscated re-encrypted ciphertext, and sending the FHE ML model parameters to the client device. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] The above and other objects, features and advantages of the present disclosure will become more apparent through a more detailed description of some embodiments of the present disclosure in the accompanying drawings, wherein like reference numerals generally refer to like components in the embodiments of the present disclosure.

[0007] Figure 1 A schematic diagram of a computing environment according to an embodiment of the present invention is provided.

[0008] Figure 2 A flow chart depicting an operational sequence according to an embodiment of the present invention is provided.

[0009] Figure 3 A schematic diagram of a network architecture according to an embodiment of the present invention is provided.

[0010] Figure 4 A timeline of communications according to an embodiment of the present invention is provided.

[0011] Figure 5 A cloud computing environment according to an embodiment of the present invention is depicted.

[0012] Figure 6 An abstract model layer according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0013] Some embodiments will be described in more detail with reference to the accompanying drawings, in which embodiments of the present disclosure are shown. However, the present disclosure can be implemented in various ways and should not be construed as limited to the embodiments disclosed herein.

[0014] In one embodiment, one or more components of the system may employ hardware and / or software to solve problems that are inherently highly technical (e.g., receiving information from a client device, applying a first transformation to the information, wherein the first transformation produces obfuscated information, sending the obfuscated information to a secure device, receiving the transformed obfuscated information from the secure device, applying a second transformation to the transformed obfuscated information to produce deobfuscated transformed information, sending the deobfuscated transformed information to the client device, etc.). Because processing power is required to facilitate, for example, FHE encryption of data and model parameters, securely sending FHE data over a network, receiving FHE data, and decrypting FHE data, these solutions are not abstract and cannot be performed as a set of mental actions by a human. Further, some of the processes performed may be performed by a dedicated computer for performing defined tasks associated with using FHE. For example, a dedicated computer may be employed to perform tasks associated with securely sending FHE data over a network, etc.

[0015] Any mathematical operation on FHE data introduces noise in the data. Noise accumulates with the depth of the operation (the number of sequential operations) and can introduce decryption errors at high levels. Efforts to reduce noise in FHE data include bootstrapping, in which an encrypted private key is used to reduce data noise. Bootstrapping can be computationally expensive to perform on a large scale. An alternative is to enable the service provider to send FHE data to a hardware assist module that has a private key to securely decrypt the FHE data and re-encrypt the FHE data before sending it back. The latter approach has two major limitations. First, an adversary monitoring the communication link between the service provider and the hardware security can discern the type of computation being performed by the service provider. Second, the hardware assist module can interpret the computation being performed by the service provider. The present disclosure provides a way to obfuscate data exchanged between the service provider and the hardware assist module to overcome the above two limitations.

[0016] A client desiring to train a machine learning model can turn to a service provider to build the model. The service provider can provide the model architecture and computing resources required to train the model. The client provides a training dataset. The client may wish to shield the training dataset data from the service provider while still utilizing the provider to build and train the model. Homomorphic encryption (HE) enables the use of encrypted data to evaluate logic circuits, or in this example, train machine learning models. Because HE data is encrypted before reaching the service provider, the service provider cannot access the underlying data values. HE data can be used for training without requiring access to the associated decryption keys or the ability to decrypt the data. HE's use for training may be limited because each step in the training process introduces noise into the encrypted data. This noise can limit the extent of machine learning possible using HE. As models are trained using HE data, the noise in the data increases. The degree of noise can render the encrypted data unusable after exceeding the system's capacity to decrypt the noisy signal. One solution involves periodically re-encrypting HE ciphertext using encryption with a private key. This process is called "bootstrapping" and reduces the noise in the ciphertext. This re-encryption / bootstrapping process may not be available on all systems and is computationally expensive to implement. The disclosed embodiments enable the exchange of FHE data across a network with an HSM service provider to reduce noise by decrypting and re-encrypting the data while maintaining the privacy and security of the data from malicious entities, such as the HSM service provider or those with access to network communication traffic.

[0017] In an embodiment, FHE data is transferred from a client to a cloud or other network service provider. The service provider utilizes the FHE data to evaluate logic circuits or in the training of machine learning models (such as neural network models). The FHE data is encrypted by the client using either the private key or the public key of a public-private key pair. The client does not transfer the private key to the service provider. The trained model or evaluated circuit generates intermediate results from the FHE input data. The intermediate results include noise due to the underlying encryption of the data. In this embodiment, the method transfers the intermediate results from the service provider's system to an external entity, such as a hardware security module (HSM). In this embodiment, the method additionally hides the intermediate results to enhance the security of the encrypted data. The HSM modifies the received ciphertext. The HSM decrypts and then re-encrypts the ciphertext containing the intermediate result received from the service provider's system. The client provides the HSM with a private key for decryption and re-encryption of the intermediate result from the service provider. The client may provide the HSM with the private key via a communication channel different from the channel used for the FHE data.

[0018] The steps of decrypting and re-encrypting the intermediate results using the private key reduce or eliminate noise in the intermediate results. Passing the re-encrypted intermediate results back to the service provider enables model training or circuit evaluation to continue using results with little, if any, noise. This enables the service provider to train model structures with more layers because noise does not accumulate in the model during training. The use of FHE training data for training the model produces a set of encrypted model parameters. After training is complete, the encrypted model parameters are passed to the client for decryption using the private key. The service provider only "sees" the encrypted data and the encrypted model parameters.

[0019] In an embodiment, the transfer of intermediate results from the service provider to the HSM and back occurs at regular intervals associated with the model architecture. The ciphertext (including the intermediate results) can be transferred to the HSM after the calculation of each layer of the network or after the noise in the results has been exhausted by the multiplication depth of the system. The spacing and number of ciphertexts are related to the nature of the architectural structure of the model and can be used as a path to obtain this information. For example, the number of model layers, the number of nodes per layer, the type of activation and training strategy can be discerned from analysis of the communication between the service provider's system and the HSM.

[0020] In an embodiment, adding an obfuscation module (OM) between the service provider's system and the HSM enhances privacy protection of the model. In this embodiment, the OM obfuscates ciphertext passed between the system and the HSM, reducing the accuracy of any information that can be obtained from any analysis of the system's HSM communication traffic.

[0021] By applying obfuscation to information, the disclosed embodiments enable communication between a CAM and a HAM without worrying about details of the CAM's processing being discernible from the messaging traffic. The obfuscation hides details that would otherwise be available when passing ciphertext associated with reducing noise in FHE data during the CAM's training of a machine learning model.

[0022] In an embodiment, the OM supplements the ciphertext containing the intermediate result with additional ciphertext. The OM sends the additional ciphertext to the HSM at random intervals, changing any regular pattern associated with the ciphertext containing the actual intermediate result.

[0023] In one embodiment, the OM changes the timing of the ciphertexts, delaying the transmission of some or all ciphertexts to change the pattern of the original stream of ciphertexts received from the service provider system. In one embodiment, the OM changes the frequency of the ciphertexts by shifting some or all ciphertexts along the timeline to remove all or part of the periodic aspect of the ciphertext stream.

[0024] In one embodiment, the ciphertext includes multiple slots, each containing a value associated with an intermediate value. In this embodiment, the OM changes the order of the slots in the ciphertext before sending the text to the HSM. Upon receiving the re-encrypted version of the ciphertext, the OM reorders the ciphertext slot values ​​back to the original order before sending the re-encrypted ciphertext back to the service provider's system.

[0025] In an embodiment, the OM randomly selects a ciphertext for re-encryption from the set of ciphertexts across the service provider system. In this embodiment, the OM may randomly select a ciphertext using any known randomization function, including random selection based on the residual ciphertext depth (how many ciphertext operations can be performed before the noise in the encrypted data exceeds the decryption noise threshold). When the residual ciphertext depth is high, the probability of selection will generally be lower. The probability of selecting a ciphertext will increase as the residual ciphertext depth decreases. As noise accumulates, the ciphertext depth decreases to a point where the ciphertext depth is exhausted, where the noise prevents further productive evaluation or development of machine learning models. As the ciphertext depth decreases, the probability of random selection increases to reduce the rising noise level before the exhaustion point. At low levels of noise, indicated by high levels of residual ciphertext depth, there is less need to reduce noise and the probability of ciphertext selection is lower.

[0026] In an embodiment, the OM determines the best tradeoff between ensuring model privacy and the computational resource cost and process delay associated with adding obfuscation. In this embodiment, the method determines the percentage of the original ciphertext stream that will be altered by obfuscation relative to the computational cost of the added ciphertext, and evaluates the total time associated with the ciphertext delay relative to the time associated with delivering the information without obfuscation.

[0027] Figure 1A schematic diagram of exemplary network resources associated with practicing the disclosed invention is provided. The present invention may be practiced in a processor of any disclosed element that processes an instruction stream. As shown, a networked hardware security module (HSM) 110 is connected to a server subsystem 102 and to a client device 104 wirelessly or via a wired connection. The HSM 110 is connected to the service provider's server subsystem 102 via an OM 112 and a network 114 via a wired or wireless connection. The client device 104 may also be connected to the server subsystem 102 via the network 114 via a wired or wireless connection. The client device 104, the HSM 110, and the OM 112 include a FHE security program (not shown) and sufficient computing resources (processor, memory, network communication hardware) to execute the program. Figure 1 As shown, server subsystem 102 includes server computer 150 . Figure 1 FIG. 1 is a block diagram illustrating components of a server computer 150 within a networked computer system 1000 according to an embodiment of the present invention. It should be understood that Figure 1 This is merely an illustration of one implementation and does not imply any limitations regarding the environments in which different embodiments may be implemented. Many modifications may be made to the depicted environment. In an embodiment (not shown), OM 112 resides within server subsystem 102. In an embodiment, all communications between server subsystem 102 and HSM 110 pass through OM 112.

[0028] Server computer 150 may include processor 154, memory 158, persistent storage 170, communication unit 152, input / output (I / O) interface 156, and communication fabric 140. Communication fabric 140 provides communication between cache 162, memory 158, persistent storage 170, communication unit 152, and input / output (I / O) interface 156. Communication fabric 140 may be implemented using any architecture designed to pass data and / or control information between processors (such as microprocessors, communication and network processors, etc.), system memory, external devices, and any other hardware components within the system. For example, communication fabric 140 may be implemented using one or more buses.

[0029] Memory 158 and persistent storage 170 are computer-readable storage media. In this embodiment, memory 158 includes random access memory (RAM) 160. In general, memory 158 may include any suitable volatile or non-volatile computer-readable storage media. Cache 162 is a fast memory that enhances the performance of processor 154 by storing recently accessed data from memory 158 and data near recently accessed data.

[0030] Program instructions and data for implementing embodiments of the present invention (e.g., FHE security program 175) are stored in persistent storage 170 for execution and / or access by one or more of the corresponding processors 154 of server computer 150 via cache 162. In this embodiment, persistent storage 170 includes a magnetic hard drive. As an alternative to or in addition to a magnetic hard drive, persistent storage 170 may include a solid-state hard drive, a semiconductor memory device, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), flash memory, or any other computer-readable storage medium capable of storing program instructions or digital information.

[0031] The media used by persistent storage 170 may also be removable. For example, a removable hard drive may be used for persistent storage 170. Other examples include optical and magnetic disks, thumb drives, and smart cards, which are inserted into a drive for transfer to another computer-readable storage medium (which is also part of persistent storage 170).

[0032] In these examples, communications unit 152 provides for communications with other data processing systems or devices, including resources of client computing devices 104 and 110. In these examples, communications unit 152 includes one or more network interface cards. Communications unit 152 may provide for communications using either or both physical and wireless communication links. Software distribution programs, as well as other programs and data used to implement the present invention, may be downloaded to persistent storage 170 of server computer 150 via communications unit 152.

[0033] The I / O interface 156 allows for input and output of data with other devices that may be connected to the server computer 150. For example, the I / O interface 156 may provide a connection to an external device 190 such as a keyboard, a keypad, a touch screen, a microphone, a digital camera, and / or some other suitable input device. The external device 190 may also include a portable computer-readable storage medium such as, for example, a thumb drive, a portable optical or magnetic disk, and a memory card. Software and data used to practice embodiments of the present invention (e.g., the FHE security program 175 on the server computer 150) may be stored on such a portable computer-readable storage medium and may be loaded onto the persistent storage 170 via the I / O interface 156. The I / O interface 156 is also connected to a display 180.

[0034] Display 180 provides a mechanism for displaying data to a user and may be, for example, a computer monitor. Display 180 may also function as a touch screen, such as the display of a tablet computer.

[0035] In an embodiment, client device 104 applies encryption to a training dataset intended for training a machine learning model. The encryption involves homomorphically encrypting the dataset using a public or public key. The homomorphically encrypted dataset is transmitted from client device 104 to server subsystem 102 via network 114. Server subsystem 102 can be local and under the control of the same entity as client device 104, or it can be a cloud resource provided by a cloud service provider for use in developing and training machine learning models. Because the server subsystem uses the provided data for evaluation or training without decrypting the data, the entire process utilizes fully homomorphic encryption (FHE). Server subsystem 102 receives FHE data from client device 104 and uses the FHE data to evaluate a specified circuit or train a specified machine learning model. During evaluation or training, the server subsystem generates intermediate values ​​or ciphertexts associated with the evaluation or training. Due to the FHE nature of the data, these ciphertexts include noise. Without any effort to reduce the noise, it will increase and cause decryption errors in the final result.

[0036] In some systems, the server subsystem 102 passes the encrypted intermediate results as a ciphertext stream, where each ciphertext includes one or more intermediate results, to the HSM 110. The HSM 110 decrypts each ciphertext using the private key received from the client 104 and then re-encrypts it. This decryption-re-encryption process reduces or eliminates noise from the intermediate results carried in the ciphertext. The HSM 110 passes the re-encrypted intermediate results back to the server subsystem 102 as a ciphertext stream corresponding to the original stream.

[0037] In such a system, the nature of the architecture of a machine learning model can be discerned using information leaked in the ciphertext stream. Information about the model, such as the number of model layers, the number of nodes per layer, CAM computation details, activation type, and training strategy, can be determined from analysis of the ciphertext stream.

[0038] exist Figure 1In the illustrated embodiment, the method adds an obfuscation module (OM) 112 to the entire networked system. OM 112 resides between the server subsystem 102 and the HSM 110, and all communication traffic between the server subsystem 102 and the HSM 110 passes through OM 112. In this embodiment, OM 112 modifies the ciphertext flow sent from the server subsystem 102 to the HSM 110. The changes obfuscate architectural details such as the number of model layers, the number of nodes per layer, the type of activation and training strategy, which are otherwise discernible from the message flow. OM 112 deobfuscates messages passed from the HSM 110 to the server subsystem 102 to provide the server subsystem with reduced noise ciphertext. In an embodiment, OM 112 exists as an embedded part of the server subsystem 102, and communication between the server subsystem 102 and the HSM 110 flows from the server subsystem 102 to OM 112, through the network 114 to the HSM 110, and back, following the same route.

[0039] After receiving the deobfuscated ciphertext, the method continues to train the ML model. Multiple epochs or iterations of training may occur. Multiple sets of intermediate ciphertext may be passed to the HSM 110 via the OM 112 and returned to the server subsystem 102. After completing training of the ML model, the method passes the set of FHE ML model parameters to the client device 104. The client device 104 decrypts the FHE ML model parameters using the client private key, enabling the client to analyze new data using the trained ML model.

[0040] Figure 2 A flowchart 200 illustrating exemplary activities associated with implementation of the present disclosure is provided. After the program begins, at block 210, the method of the FHE security program 175, acting through an obfuscation module (OM), receives information from a client device, such as a computing agent module (CAM). In an embodiment, the information includes ciphertext including FHE data intermediate results from the CAM, and the CAM includes a system processor of a cloud-based service provider that trains a machine learning model for a remote client. The received information includes data encrypted using a private key or a public key of the client of the CAM.

[0041] At block 220, the method of the FHE security program 175, acting through the OM, applies a first transformation to the information received from the CAM. The applied transformation may supplement the information by adding false information, such as generated "fake" ciphertext, to the received information. The addition of the fake ciphertext changes the ciphertext pattern in communications downstream of the OM. This change obfuscates any information discernible in the original stream of information received from the CAM, including the number of model layers, the number of nodes per layer, the type of activation and training strategy, and CAM computational details. The applied transformation may include additionally blinding the received information by adding data to each received ciphertext so that the information passed downstream is no longer identical to the information received from the CAM.

[0042] In an embodiment, the applied transformation introduces a random delay in the timing or frequency of delivering received ciphertext or other information to a downstream element. In this embodiment, the delay may include delaying the timing of all or a portion of the original ciphertext stream, or altering the timing of all or a portion of the original ciphertext while also adding false ciphertext to the received information stream delivered to the downstream element. In an embodiment, the method may alter the frequency of the ciphertext by shifting some or all of the received ciphertext to disrupt any regular frequency pattern associated with the received ciphertext.

[0043] In one embodiment, the applied transformation randomly selects received ciphertexts and sends only the selected ciphertexts for downstream processing, such as decryption or re-encryption by an HSM. In this embodiment, the transformation may randomly select a ciphertext using a random number generator to determine the next ciphertext for downstream processing. For example, from the first selected ciphertext, the transformation determines a random number indicating the number of ciphertexts to skip before selecting the next ciphertext for downstream processing. Selecting only a portion of the entire ciphertext set for downstream processing increases FHE security by changing any original pattern of the ciphertext message, but results in more noise in the entire ciphertext stream used by the CAM to evaluate circuits or train machine learning models. The entire stream contains more noise because only a portion of the stream is passed to the HSM for decryption or re-encryption. In this embodiment, the method selects ciphertexts based on the remaining ciphertext depth.

[0044] In an embodiment, the method balances the computational costs associated with different obfuscation techniques with the extent to which each technique or combination of techniques alters the original flow of information provided by the CAM.

[0045] At block 230, the method of the FHE security program 175 sends the transformed information from the OM to a downstream entity, such as a hardware assistance module (HAM), such as a hardware security module (HSM). The information sent to the HAM / HSM has been altered by the OM and is no longer the same information stream that the OM received from the CAM.

[0046] The HAM / HSM transforms information received from the OM. In an embodiment, the HSM decrypts the information received from the OM using an encryption private key provided directly to the HSM by the client or client device and then re-encrypts the information. The steps of decrypting and re-encrypting the information reduce or eliminate the noise introduced by the original encryption applied by the client to the original data before sending the data from the client to the CAM for processing. The change in the noise level in the intermediate results enables the CAM to train a wider range of deeper machine learning models using FHE from the client. Although deeper models can be trained due to noise reduction, the CAM still lacks any ability to decrypt the client training data or see the client's unencrypted data. Due to the obfuscation of the information flow passed from the CAM to the HAM, the HAM lacks any ability to derive meaningful information about the circuit being evaluated or the model being trained from the provided information flow. After decrypting and re-encrypting the information received from the OM, the HAM sends the re-encrypted information to the OM.

[0047] At block 240, the FHE security program 175 method, OM, receives the transformed obfuscated information from the HAM / HSM. The original obfuscated information has been decrypted and re-encrypted by the HSM, removing the accumulated noise from the information.

[0048] The OM applies the inverse of the original obfuscation transform to the received information at block 250. For example, the OM removes the false ciphertext from the received information and removes any additional blinding from the received ciphertext.

[0049] At block 260, the FHE security program 175 method sends the deobfuscated transformed information to the CAM. For example, the OM deobfuscates the re-encrypted ciphertext stream received from the HSM, removing previously added spurious ciphertext and any additional blinding artifacts. The OM then sends the deobfuscated ciphertext stream to the CAM for further use in evaluating circuits or training machine learning models. In an embodiment, the method uses the received re-encrypted ciphertext to determine ML model parameters. The use of FHE data and encrypted ciphertext produces FHE ML model parameters that cannot be read by the MLaaS provider.

[0050] At block 270, the method passes the FHE ML model parameters back to the client device. In this embodiment, the client device decrypts the received FHE ML model parameters. The client can then use the decrypted ML model parameters to analyze new data.

[0051] Figure 3 A schematic diagram 300 of a networked computing environment according to an embodiment of the present invention is provided. Schematic diagram 300 illustrates a scenario in which a client possesses a training dataset 311 and desires an ML model with ML model parameters 315 for analyzing the data. As shown, at 312, the training data 311 is converted to fully homomorphically encrypted (FHE) training data and passed from the client device 310 to an MLaaS provider server 320. At 312, the client device 310 encrypts the training data using either the client's private key or the client's public key from a client private-public key pair, thereby generating FHE training data. The MLaaS server 320 uses the FHE training data to train an ML model 322. Progress in ML model training results in the generation of intermediate results in the form of encrypted ciphertexts. These ciphertexts include noise resulting from the use of FHE training data. The method passes the encrypted ciphertexts through an obfuscation module (OM) 330 to alter the ciphertext stream, concealing otherwise discernible information about the ML model, including the number of model layers, the number of nodes per layer, activation types, and training strategy. OM 330 may add false ciphertext, vary the frequency of ciphertext, randomly select only a portion of the total stream of ciphertext, or otherwise change the pattern of the ciphertext information.

[0052] As shown, the method passes the obfuscated ciphertext from OM 330 to an external HSM 340. Client device 310 provides HSM 340 with the client private key 318 of the client private-public key pair associated with encrypted FHE training data 312. The HSM decrypts and then re-encrypts the received intermediate ciphertext using the received private key 318. Decrypting and subsequently re-encrypting the ciphertext reduces the noise in the ciphertext, enabling MLaaS server 320 to further train the ML model.

[0053] HSM 340 passes the re-encrypted ciphertext back to MLaaS provider server 320 via OM 330. OM 330 de-obfuscates the re-encrypted ciphertext stream, removing the previously applied obfuscation from the stream.

[0054] The MLaaS server 320 uses the re-encrypted ciphertext to further train the ML model 322. The MLaaS server 320 can pass multiple iterations of the intermediate result ciphertext to the HSM 340 via the OM 330, which in turn receives the corresponding re-encrypted ciphertext. This iteration can continue until the MLaaS server 320 has fully trained the ML model. The fully trained ML model includes a set of FHE ML model parameters that define the ML model. The FHE ML model parameters are encrypted and cannot be read by the MLaaS provider. The MLaaS server 320 passes the FHE ML model parameters to the client device 310. At 314, the client device 310 decrypts the FHE ML model parameters using the client private key. The client device 310 then possesses the decrypted ML model parameters 315 and can build and use the ML model to analyze new data.

[0055] Figure 4 A communication messaging timeline between the CAM and HSM is shown, with data not obfuscated at 410 and obfuscated as described above at 420. As shown, the regular pattern and spacing of messages 415 arranged along timeline 410 and transmitted without the disclosed obfuscation have been eliminated by adding an OM between the CAM and HSM to obfuscate the information flow. The obfuscated message flow 425 arranged along timeline 420 no longer contains exposed ML model architecture details.

[0056] The disclosed embodiments provide for the use of MLaaS remote resources available from edge clouds or cloud resource providers. These resources enable MLaaS consumers to access ML frameworks and associated computing environment resources on demand.

[0057] It should be understood that although the present disclosure includes detailed descriptions about cloud computing, the implementation of the teachings cited herein is not limited to cloud computing environments. Instead, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0058] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be quickly provisioned and released with minimal management effort or interaction with the service provider. The cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0059] Features are as follows:

[0060] On-demand self-service: Cloud consumers can unilaterally and automatically provision computing capabilities, such as server time and network storage, as needed, without requiring human interaction with the service provider.

[0061] Broad Network Access: Capabilities are available over the network and accessed through standard mechanisms that facilitate the use of heterogeneous thin-client or thick-client platforms (e.g., mobile phones, laptops, and PDAs).

[0062] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically assigned and reassigned as needed. There is a sense of location independence, as consumers typically do not have control or knowledge of the exact location of the provided resources, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0063] Rapid elasticity: The ability to quickly and elastically provision capacity, in some cases automatically scaling down and releasing capacity to scale up quickly. To the consumer, the capacity available for provisioning typically appears unlimited and can be purchased in any quantity at any time.

[0064] Measured services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the utilized services.

[0065] The service model is as follows:

[0066] Machine Learning as a Service (MLaaS): This provides consumers with the ability to leverage a provider's machine learning model architecture to train an ML model using their own training data and subsequently utilize the trained model. The consumer passes data to the provider and receives output from the trained model. The consumer does not manage the underlying cloud resources used for the model.

[0067] Software as a Service (SaaS): The ability provided to consumers is to use the provider's applications running on a cloud infrastructure. Applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based email). Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0068] Platform as a Service (PaaS): The capability provided to consumers is to deploy applications created or acquired using programming languages ​​and tools supported by the provider onto cloud infrastructure. Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but do have control over the deployed applications and the configuration of the application hosting environment.

[0069] Infrastructure as a Service (IaaS): The capabilities provided to consumers are processing, storage, networking, and other basic computing resources on which consumers can deploy and run arbitrary software, which can include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but rather have control over the operating system, storage, deployed applications, and potentially limited control over selected networking components (e.g., host firewalls).

[0070] The deployment model is as follows:

[0071] Private cloud: Cloud infrastructure is operated solely for an organization. It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0072] Community cloud: Cloud infrastructure is shared by several organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0073] Public cloud: Cloud infrastructure is made available to the public or large industry groups and is owned by the organization that sells cloud services.

[0074] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0075] Cloud computing environments are service-oriented and focus on statelessness, low coupling, modularity, and semantic interoperability. The core of cloud computing is the infrastructure that consists of a network of interconnected nodes.

[0076] Now see Figure 5, depicts an illustrative cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers can communicate, such as, for example, personal digital assistants (PDAs) or cellular phones 54A, desktop computers 54B, laptop computers 54C, and / or automobile computer systems 54N. The nodes 10 can communicate with each other. They can be grouped (not shown) physically or virtually in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds, or a combination thereof, as described above. This allows the cloud computing environment 50 to provide infrastructure, platforms, and / or software as services for which cloud consumers do not need to maintain resources on local computing devices. It should be understood that Figure 5 The types of computing devices 54A-N shown in are intended to be illustrative only, and computing node 10 and cloud computing environment 50 may communicate with any type of computerized device over any type of network and / or network-addressable connection (eg, using a web browser).

[0077] Now see Figure 6 , showing the cloud computing environment 50 ( Figure 5 ) provides a set of functional abstraction layers. It should be understood in advance that Figure 6 The components, layers, and functions shown in are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As described, the following layers and corresponding functions are provided:

[0078] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: mainframes 61; servers based on RISC (Reduced Instruction Set Computer) architecture 62; servers 63; blade servers 64; storage devices 65; and network and networking components 66. In some embodiments, software components include web application server software 67 and database software 68.

[0079] Virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 71 ; virtual storage 72 ; virtual networks 73 , including virtual private networks; virtual applications and operating systems 74 ; and virtual clients 75 .

[0080] In one example, the management layer 80 may provide the functionality described below. Resource provisioning 81 provides dynamic procurement of computing and other resources for performing tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking when utilizing resources within the cloud computing environment and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides cloud computing resource allocation and management so that required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides pre-scheduling and procurement of cloud computing resources in anticipation of future demand according to the SLA.

[0081] The workload layer 90 provides examples of functionality that can utilize a cloud computing environment. Examples of workloads and functionality that can be provided from this layer include mapping and navigation 91; software development and lifecycle management 92; virtual classroom instruction delivery 93; data analytics processing 94; transaction processing 95; and FHE security programs 175.

[0082] The present invention may be a system, method, and / or computer program product in any possible degree of integration of technical details. The present invention may be beneficially practiced in any system (single or parallel) that processes instruction streams. The computer program product may include a computer-readable storage medium having computer-readable program instructions thereon for causing a processor to perform various aspects of the present invention.

[0083] Computer-readable storage medium can be a tangible device that can retain and store the instructions used by the instruction execution device.Computer-readable storage medium can be, for example but not limited to, electronic storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or any suitable combination of the above.The non-exhaustive list of more specific examples of computer-readable storage medium includes the following: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device such as the protruding structure in the punch card or groove with the instruction recorded thereon and any suitable combination of the above.Computer-readable storage medium or computer-readable storage device as used herein itself should not be interpreted as temporary signal, such as radio wave or other free propagating electromagnetic wave, electromagnetic wave (such as, light pulse by fiber optic cable) propagated by waveguide or other transmission medium or electric signal transmitted by wire.

[0084] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network), or downloaded to an external computer or external storage device. The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium within the corresponding computing / processing device.

[0085] The computer-readable program instructions for performing the operation of the present invention can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, the configuration data of integrated circuit or source code or object code written in any combination of one or more programming languages, these programming languages ​​include object-oriented programming languages ​​(such as Smalltalk, C++ etc.) and process programming languages ​​(such as " C " programming languages ​​or similar programming languages). The computer-readable program instructions can be performed completely on the user's computer, partly on the user's computer, performed as an independent software package, partly on the user's computer, partly on a remote computer or fully on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer by any type of network (including local area network (LAN) or wide area network (WAN)), or can be connected to an external computer (for example, using an internet service provider through the internet). In certain embodiments, the electronic circuit comprising for example programmable logic circuit, field programmable gate array (FPGA) or programmable logic array (PLA) can make the electronic circuit personalized to perform computer-readable program instructions by utilizing the state information of computer-readable program instructions, so as to perform various aspects of the present invention.

[0086] The present invention will be described below with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0087] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in the flowchart and / or block diagram or multiple blocks. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can direct the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable storage medium with the instructions stored therein includes an article of manufacture containing instructions for implementing various aspects of the functions / actions specified in the flowchart and / or block diagram or multiple blocks.

[0088] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable apparatus, or other device to produce computer-implemented processing, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in the flowchart and / or block diagram or multiple boxes.

[0089] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functions and operations of possible implementations of the systems, methods and computer program products according to different embodiments of the present invention. To this end, each box in the flowchart or block diagram may represent a module, segment or portion of an instruction, which includes one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions annotated in the box may not occur in the order annotated in the figure. For example, depending on the functions involved, two blocks shown in succession may actually be executed substantially simultaneously, or the blocks may sometimes be executed in the opposite order. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs a specified function or action or performs a combination of dedicated hardware and computer instructions.

[0090] References in the specification to "embodiment," "example," "example embodiment," etc. indicate that the described embodiment may include a particular feature, structure, or characteristic, but every embodiment may not necessarily include the particular feature, structure, or characteristic. In addition, such phrases do not necessarily refer to the same embodiment. Further, when a particular feature, structure, or characteristic is described in conjunction with an embodiment, it is considered within the knowledge of those skilled in the art to affect such feature, structure, or characteristic in conjunction with other embodiments (whether or not explicitly described).

[0091] The terms used herein are for the purpose of describing specific embodiments only and are not intended to limit the present invention. As used herein, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include the plural forms as well. It should also be understood that when the terms "comprises" and / or "comprising" are used in this specification, they specify the presence of the features, integers, steps, operations, elements and / or parts, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, parts and / or combinations thereof.

[0092] The description of various embodiments of the present invention has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the invention. The terminology used herein is selected to best explain the principles of the embodiments, practical applications, or technical improvements over technologies found in the marketplace, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. A computer-implemented method, comprising: Receive fully homomorphically encrypted (FHE) information from the client device; Using the FHE information to train a machine learning (ML) model to generate FHE ciphertext; Applying a first transformation to the FHE ciphertext to produce an obfuscated FHE ciphertext; Sending the obfuscated FHE ciphertext to a secure device; receiving a re-encrypted version of the obfuscated FHE ciphertext from the secure device; applying a second transformation to the re-encrypted version of the obfuscated FHE ciphertext to produce a deobfuscated re-encrypted FHE ciphertext; Training the ML model using the re-encrypted FHE ciphertext to generate FHE ML model parameters; and The FHEML model parameters are sent to the client device.

2. The computer-implemented method of claim 1 , wherein: The FHE information includes data encrypted using a client device private key or a client device public key.

3. The computer-implemented method of claim 1 , wherein: The re-encrypted obfuscated FHE ciphertext includes the obfuscated FHE ciphertext re-encrypted using the client device private key.

4. The computer-implemented method of claim 1 , wherein: The security device includes a hardware security module (HSM).

5. The computer-implemented method of claim 1 , wherein: Applying the first transform obfuscates frequency aspects of the FHE ciphertext.

6. The computer-implemented method of claim 1 , wherein: The first transformation is randomly applied to the FHE ciphertext.

7. The computer-implemented method of claim 1 , wherein: Applying the first transformation adds dummy data to the information.

8. A computer program product for protecting homomorphically encrypted data, the computer program product comprising one or more computer-readable storage devices and program instructions stored collectively on the one or more computer-readable storage devices, the stored program instructions comprising: Program instructions for receiving fully homomorphically encrypted (FHE) information from a client device; Program instructions for training a machine learning (ML) model using the FHE information to generate FHE ciphertext; Program instructions for applying a first transformation to the FHE ciphertext to produce obfuscated FHE ciphertext; Program instructions for sending the obfuscated FHE ciphertext to a secure device; program instructions for receiving a re-encrypted version of the obfuscated FHE ciphertext from the secure device; program instructions for applying a second transformation to a re-encrypted version of the obfuscated FHE ciphertext to produce a deobfuscated re-encrypted FHE ciphertext; Program instructions for training the ML model using the re-encrypted FHE ciphertext to generate FHE ML model parameters; as well as Program instructions for sending the FHEML model parameters to the client device.

9. The computer program product according to claim 8, wherein: The FHE information includes data encrypted using a client device private key or a client device public key.

10. The computer program product of claim 8, wherein: The re-encrypted obfuscated FHE ciphertext includes the obfuscated FHE ciphertext re-encrypted using the client device private key.

11. The computer program product of claim 8, wherein: The security device includes a hardware security module (HSM).

12. The computer program product of claim 8, wherein: Applying the first transform obfuscates frequency aspects of the FHE ciphertext.

13. The computer program product of claim 8, wherein: The first transformation is randomly applied to the FHE ciphertext.

14. The computer program product of claim 8, wherein: Applying the first transformation adds dummy data to the information.

15. A computer system for protecting homomorphically encrypted data, the computer system comprising: one or more computer processors; one or more computer-readable storage devices; as well as Program instructions stored on the one or more computer-readable storage devices for execution by the one or more computer processors, the stored program instructions comprising: Program instructions for receiving fully homomorphically encrypted (FHE) information from a client device; Program instructions for training a machine learning (ML) model using the FHE information to generate FHE ciphertext; Program instructions for applying a first transformation to the FHE ciphertext to produce obfuscated FHE ciphertext; Program instructions for sending the obfuscated FHE ciphertext to a secure device; program instructions for receiving a re-encrypted version of the obfuscated FHE ciphertext from the secure device; program instructions for applying a second transformation to a re-encrypted version of the obfuscated FHE ciphertext to produce a deobfuscated re-encrypted FHE ciphertext; Program instructions for training the ML model using the re-encrypted FHE ciphertext to generate FHE ML model parameters; and Program instructions for sending the FHE ML model parameters to the client device.

16. The computer system according to claim 15, wherein: The FHE information includes data encrypted using a client device private key or a client device public key.

17. The computer system according to claim 15, wherein: The re-encrypted obfuscated FHE ciphertext includes the obfuscated FHE ciphertext re-encrypted using the client device private key.

18. The computer system according to claim 15, wherein: The security device includes a hardware security module (HSM).

19. The computer system according to claim 15, wherein: Applying the first transform obfuscates frequency aspects of the FHE ciphertext.

20. The computer system of claim 15, wherein the first transformation is randomly applied to the FHE ciphertext.

Images